CVE-2026-68140 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
net/iucv: fix use-after-free of a severed iucv_path
af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path.
Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described represents a critical use-after-free condition within the Linux kernel's IUCV (Inter-User Communication Vehicle) networking subsystem. This flaw exists in the network protocol handling mechanism that facilitates communication between mainframe systems and Linux environments through the IBM z/VM hypervisor. The issue manifests when an IUCV connection undergoes a severed state, creating a scenario where memory management becomes inconsistent and potentially exploitable.
The technical root cause stems from improper synchronization between connection state management and message queue processing within the IUCV subsystem. When a peer severs an IUCV connection, the system correctly frees the associated iucv_path structure through the iucv_path_free() function but fails to clean up the queued message notifications that reference this freed memory. These notifications remain in the iucv->message_q queue as raw pointers pointing to deallocated memory locations. The subsequent processing of these stale references during recvmsg() operations triggers a use-after-free condition when the system attempts to access the freed iucv_path structure through the message_receive() function.
This vulnerability directly maps to CWE-416, which defines Use After Free conditions where software continues to reference memory after it has been freed. The flaw represents a classic memory safety issue that can lead to arbitrary code execution or system instability. From an operational perspective, this vulnerability impacts systems running Linux kernels with IUCV support, particularly those in mainframe environments where such communication channels are actively utilized for mission-critical applications.
The exploitation potential of this vulnerability aligns with ATT&CK technique T1059.007 for command and control communications, though the primary risk lies in system stability rather than direct privilege escalation. The use-after-free condition can result in kernel crashes, memory corruption, or potentially enable attackers to execute malicious code within kernel space if proper exploitation techniques are applied. Organizations using IBM z/VM environments with Linux on System z should prioritize patching this vulnerability as it represents a significant risk to system availability and integrity.
The recommended mitigation strategy involves implementing proper cleanup of queued notifications when an IUCV path is severed, ensuring that all references to freed memory structures are removed from the message queue before the path itself is deallocated. This approach addresses the fundamental synchronization issue between connection termination and message processing, preventing the scenario where stale pointers continue to reference deallocated memory. The fix specifically targets the iucv_sever_path() function to drop queued notifications when the path is severed, thereby eliminating both the immediate use-after-free condition and the memory leak that occurs when sockets are closed with pending messages in the queue. This remediation aligns with standard kernel security practices for preventing memory safety vulnerabilities in network subsystems and ensures proper resource management throughout the connection lifecycle.